CVE-2025-62526: OpenWrt ubusd vulnerable to heap buffer overflow
OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, ubusd contains a heap buffer overflow in the event registration parsing code. This allows an attacker to modify the head and potentially execute arbitrary code in the context of the ubus daemon. The affected code is executed before running the ACL checks, all ubus clients are able to send such messages. In addition to the heap corruption, the crafted subscription also results in a bypass of the listen ACL. This is fixed in OpenWrt 24.10.4. There are no workarounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenWrt ubusdto a version that resolves this vulnerability.Fixed in 24.10.4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62526?
The severity of CVE-2025-62526 is high due to the heap buffer overflow vulnerability that may allow code execution.
How do I fix CVE-2025-62526?
To fix CVE-2025-62526, update to OpenWrt version 24.10.4 or later.
What software is affected by CVE-2025-62526?
CVE-2025-62526 affects OpenWrt ubusd versions prior to 24.10.4.
Can CVE-2025-62526 lead to remote code execution?
Yes, CVE-2025-62526 can potentially allow an attacker to execute arbitrary code due to the vulnerability.
Is there a workaround for CVE-2025-62526?
There is no known workaround; the recommended action is to upgrade to a patched version.